Crates / cargo-vet
Rust crate · real downloads · data Oct 27, 2026
cargo-vet downloads, and should you depend on it?
Supply-chain security for Rust crates.io · docs.rs · repository
Few direct dependents and steady.
cargo-vet: only 0 crates name it directly; downloads jump on release days (1.6x the baseline).
How this verdict is decided (4 rules)
- Usage: crates.io reverse dependencies (crates that list it as a dependency): 10,000+ = foundational, 1,000+ = widely used, 100+ = established, under 100 = few direct dependents.
- Direction: the median quiet day in the last 30 days of the window against the first 30, read against the median tracked crate (the whole field moved +39% from late summer to October, so a raw trend says nothing). 10%+ ahead of the field = gaining; 10%+ behind = losing ground; otherwise steady. Steady with no release in 2+ years = quiet for years.
- Release spikes: the median release-window day against the quiet-day baseline: under 1.15x = no spike, 1.15x to 1.3x = small bumps, 1.3x or more = jumps on release days.
- Release recency: days since the newest version that was not yanked, from crates.io publish times.
release window (release day + next day)quiet dayquiet-day median · download the 89 days as CSV
The numbers in one paragraphcargo-vet got 121,306 crates.io downloads from Jul 30, 2026 to Oct 26, 2026. 3% of them landed within 2 days of one of its 1 release. On the other 87 quiet days it got a median of 1,301 a day, about 9,107 a week. Capping release days at that baseline leaves 119,688 release-adjusted downloads for the window.
What this means if you're choosing a dependency
- You rarely add this one yourself. Only 0 crates name it directly.
- Actively released. 0.10.3 shipped 5 days ago (Oct 22, 2026).
- Still pre-1.0 (0.10.3). Under Cargo's semver rules a 0.x minor bump may break you, so pin the minor version (
cargo-vet = "0.10") and read the changelog on upgrades. - Fit check: license Apache-2.0/MIT, edition 2021, needs Rust 1.85 or newer (from the latest version's manifest).
- Compare it by the baseline, not the raw count. 3% of its 121,306 downloads in the window landed within 2 days of a release; the steady number is 1,301 a day.
What the chart says
- Weekend quiet days ran at 72% of weekday quiet days (966 vs 1,342). A moderate dip: a mix of work-week builds and always-on automation.
- Biggest day: 2,357 on Oct 19, 2026, a quiet day with no release nearby.
Every number
| All-time downloads | 695,327 (outside the crates.io top 1,000 by all-time downloads) |
| Downloads in the window | 121,306 (Jul 30, 2026 to Oct 26, 2026, 89 days) |
| Within 2 days of a release | 4,220 (3.5%) |
| Quiet-day median (baseline) | 1,301 a day; weekdays 1,342, weekends 966 |
| Release-adjusted downloads | 119,688 (release-window days capped at the baseline) |
| Baseline rank | #1259 of the 1329 crates we track |
| Quiet-day trend | +51% raw, +9% against the median tracked crate (+39%) |
| Releases in the window | 1 |
| Versions published, ever | 18 |
| Latest version | 0.10.3, published Oct 22, 2026 (license Apache-2.0/MIT, edition 2021, MSRV 1.85) |
| First published | Mar 14, 2022 |
| Reverse dependencies | 0 |
Releases in the window
Each one opens a 2-day release window on the chart.
| Version | Published | Downloads that version got (lifetime) |
|---|---|---|
| 0.10.3 | Oct 22, 2026 | 3,317 |
How we compute this
crates.io counts every download, including CI runners, mirrors and bots that fetch each new version, so raw counts run high (why, in The Manual). We split the last 89 days into release windows (the day a version of cargo-vet was published, plus the next day) and quiet days, and use the median quiet day as the baseline: an upper bound on steady use, never a head count. The method and data come from our study of 90 days of crates.io data from 69 crates, featured in This Week in Rust #674; check any crate live with the real-downloads checker.
Badge for your README
Maintainers can show the baseline in a README. It is optional, updates when we refresh the data, and links back here. Preview, then copy:
README, light
README, dark
Publishing a crate of your own? How to publish a Rust crate to crates.io, step by step.
Categories
Sources
- Daily downloads: crates.io API, /crates/cargo-vet/downloads (last 90 days, all versions), fetched Oct 27, 2026.
- Versions and publish times: crates.io API, /crates/cargo-vet/versions, same fetch.
- Reverse dependencies: crates.io reverse dependencies, same fetch. Dependency edges between tracked crates: each crate's default version, crates.io API.
- Fetched politely (one request every 2 seconds, identified User-Agent) per the crates.io data access policy. Data is crates.io's; the release-window split, baseline and verdict rules are ours, CC BY 4.0.
Up next
Next by real downloads: The next crate down the real-downloads ranking: 1,298 a day. Few direct dependents and gaining.extism-pdkRust crate. Extism Plug-in Development Kit (PDK) for Rust. Real use: 1.3K downloads a day on quiet days; 27 crates depend on it.Read it next →Also worth your time
Art: Nicholas Roerich, Nag Lake (1925). Public domain, via Wikimedia Commons.
.jpg){kind=link}